In the /update endpoint, backend currently allows changing registration_status to anything that follows the graph. However, we do not want to allow users to update their own status to either rejected, confirmation, waitlist, confirmed, or checked_in. This can be abused by querying the API directly to update users' own registration statuses.
The API should only allow these updates for users with role "organizer" or "director". On that note, the role field must be added to the locked properties to prevent users from changing their role through the API. Before updating this, confirm that the frontend code does not currently set the role property. If it does, you will need to modify the frontend code first to remove that and also ensure role is being set by backend only upon user creation.
In the
/updateendpoint, backend currently allows changingregistration_statusto anything that follows the graph. However, we do not want to allow users to update their own status to eitherrejected,confirmation,waitlist,confirmed, orchecked_in. This can be abused by querying the API directly to update users' own registration statuses.The API should only allow these updates for users with
role"organizer" or "director". On that note, therolefield must be added to the locked properties to prevent users from changing their role through the API. Before updating this, confirm that the frontend code does not currently set theroleproperty. If it does, you will need to modify the frontend code first to remove that and also ensureroleis being set by backend only upon user creation.